ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

影響: pip:onnx >= 1.2.1, <= 1.21.0 → 1.22.0

ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernel_shape attribute. The inference function derived an empty effective_kernel_shape vector from the undersized weight tensor, then indexed that vector once for each spatial dimension of the input tensor. A crafted model passed onnx.checker.check_model() and caused SIGSEGV when passed to onnx.shape_inference.infer_shapes(). Technical details…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:16, GitHub Advisory Database에서 "ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-115920.